Question

A SysOps administrator manages a fleet of Amazon EC2 Linux instances running a custom application that writes logs to /var/log/app/transactions.log. The security team requires that these application log files be centrally collected in CloudWatch Logs so they can be searched and retained for 90 days. The instances already have an IAM instance profile attached. What is the MOST operationally efficient way to meet this requirement?

Accepted Answer

Install and configure the CloudWatch agent on the instances with a logs collection configuration that specifies the file path and log group, then set the log group retention to 90 days.

Answer

Write a cron job on each instance that uses the AWS CLI to call PutLogEvents every minute with the contents of the log file.

Answer

Enable EC2 detailed monitoring, which automatically forwards all instance log files to CloudWatch Logs.

Answer

Create a CloudWatch metric filter on the instance that reads the log file directly and streams matching lines to a log group.